SBI Crypto hack — September 2025

On 24 September 2025, addresses associated with SBI Crypto, the overseas bitcoin mining subsidiary of Japan's SBI Holdings, began sending funds out across five networks: Bitcoin, Ethereum, Litecoin, Dogecoin and Bitcoin Cash. Blockchain investigator ZachXBT, working with the security firm Cyvers, published the finding on 1 October and valued the outflows at roughly $21 million. He traced the funds through five instant-swap services and then into Tornado Cash.

SBI Holdings issued a notice on 2 October confirming an unauthorised outflow of crypto assets that SBI Crypto held as its own property. The company said it was investigating the cause and determining the amount lost, and that the effect on consolidated results would be minor. It stated that SBI VC Trade and BITPoint Japan, its Japanese exchange businesses, are separate entities from SBI Crypto and that no customer assets were affected. SBI has never published a technical account of how the wallets were compromised.

The two figures in circulation measure different things. ZachXBT's roughly $21 million is the market value of the assets that left the addresses at the time. SBI Holdings' half-year disclosure later recorded a loss of approximately 2.5 billion yen at SBI Crypto arising from the unauthorised outflow, on the order of $17 million at prevailing rates. That is an accounting figure rather than an on-chain valuation, and the company has not published a reconciled dollar total.

ZachXBT said the laundering pattern resembled techniques documented in earlier thefts attributed to North Korean state-linked operators. No source names a specific threat group for this incident, no government has attributed it and no charges have been brought. The funds have not been recovered. In the same disclosure that recorded the loss, SBI said SBI Crypto plans to withdraw from the mining business, a step it described as having been under consideration for some time rather than as a consequence of the theft.